CVE-2024-37921: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in Kiboko Labs Chained Quiz WordPress plugin affecting versions up to 1.3.2.8. The vulnerability was reported on June 18, 2024, and publicly disclosed on July 9, 2024 (Patchstack).

The vulnerability is classified as a Broken Access Control issue (CWE-862) with a CVSS v3.1 score of 5.3 (Medium), and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The issue stems from missing authorization checks that could allow unprivileged users to execute certain higher privileged actions (Patchstack).

The vulnerability allows unauthenticated users to exploit incorrectly configured access control security levels. While classified as low severity, it could potentially lead to unauthorized access to certain plugin functionalities (Patchstack).

The vulnerability is considered to have low complexity and requires no user interaction to exploit. However, it has been assessed as having a low likelihood of exploitation due to its limited impact (Patchstack).

The vulnerability has been fixed in version 1.3.2.9 of the Chained Quiz plugin. Users are recommended to update to this version or later to resolve the security issue (Patchstack).